AI Chatbots on Your Website: What to Disclose to Customers

Website chat tools now come with AI built in. They can answer “Do you service my area?” at midnight and collect a name and number. Before you switch one on, it helps to know the rules that already exist and the problems that show up most. This guide is general information, not legal advice; laws differ by state, and a lawyer licensed in your state can tell you how they apply to your business.

What does California’s bot law say?

California: Business and Professions Code sections 17940 to 17943, added by Senate Bill 1001 and operative since July 1, 2019, cover bots that talk to people online.

• The law defines a “bot” as “an automated online account where all or substantially all of the actions or posts of that account are not the result of a person.”
• Section 17941 makes it unlawful to use a bot to communicate with a person in California online “with the intent to mislead the other person about its artificial identity” for the purpose of knowingly deceiving them about the content of the communication in order to incentivize a purchase or sale of goods or services, or to influence a vote in an election.
• The same section says a person using a bot “shall not be liable under this section if the person discloses that it is a bot.”
• The disclosure must be “clear, conspicuous, and reasonably designed to inform persons with whom the bot communicates or interacts that it is a bot.”

In plain words: if your chatbot talks to Californians about buying your services, telling them clearly that it’s a bot is the protection the law itself describes. Section 17942 adds that these duties are cumulative with other laws, so the bot law isn’t the only rule that applies.

Other states: other states have passed or proposed their own AI disclosure rules, and they change often. We only describe laws whose text we have read. Check your own state’s current rules before you launch.

What has the FTC said about AI and deception?

Federal (FTC): on September 25, 2024, the FTC announced “Operation AI Comply,” a set of law enforcement actions against companies using AI in deceptive ways. Then-Chair Lina M. Khan said, “Using AI tools to trick, mislead, or defraud people is illegal,” and that the FTC’s actions “make clear that there is no AI exemption from the laws on the books.”

One case shows how claims can go wrong. The FTC said DoNotPay claimed its service was “the world’s first robot lawyer,” but that the product didn’t live up to its claims. The proposed settlement announced that day required a $193,000 payment and barred claims about substituting for any professional service without evidence. The lesson for a small business: don’t let your chatbot, or your marketing about it, claim more than it can do.

How should you word a chatbot disclosure?

Make it plain, short and visible before or at the start of the conversation, not hidden in your terms. Examples you can adapt:

• “Hi, I’m an automated assistant for [business name]. I can answer common questions and take your details. A person on our team will follow up.”
• Chat window title: “Automated assistant: ask a question or leave your number.”
• When handing off: “I’m passing this to a person on our team. They’ll reply during business hours.”

Avoid giving the bot a human name and photo that suggest it’s a staff member. Google’s helpful-content guidance makes a related point about websites: it calls fabricated creator profiles, such as AI-generated headshots or made-up names, deception.

How do you set up a chatbot so it doesn’t make things up?

NIST’s generative AI profile (NIST AI 600-1) warns of “confabulation”: “the production of confidently stated but erroneous or false content.” A chatbot that invents a price or a warranty term is a customer service problem and possibly a legal one. Most website chat tools let you control what the bot draws from. Set it up this way:

1. Give it an approved fact sheet. Services, service area, hours, how quotes work, and nothing else.
2. Tell it what not to do, and what to do instead. No prices beyond your published ones, no booking promises, no legal, health or safety advice; offer to have a person call.
3. Collect only what you need. Name, phone or email, ZIP and a short description. No payment details in chat.
4. Hand off to a person for anything outside the fact sheet, any complaint and any emergency.
5. Test it with 20 real customer questions, including tricky ones, before going live.
6. Read the transcripts every week for the first month and fix wrong answers.

What about privacy?

A chatbot collects personal information, so your privacy policy should say so: what the chat tool collects, who provides the tool, and how long chats are kept. Read the vendor’s terms to see whether chat content is used to train its models. If you offer chat in a state with its own privacy law, check that law too.

Is a website chatbot worth it for a small business?

It depends on your leads. If most customers call, a chatbot may add little. If many visitors arrive after hours with simple questions, a well-set-up bot that collects details for a morning callback can help. Start with the simpler fixes first: a clear contact form, accurate hours and fast replies. See our guides to building a lead page and answering new leads fast, and for replies a person sends, using AI to draft customer replies.

Chatbot launch checklist

• The chat window says plainly that it’s an automated assistant.
• No human name or photo that suggests the bot is a person.
• The bot answers only from an approved fact sheet.
• Anything else goes to a person, with a clear handoff message.
• No payment details collected in chat.
• Privacy policy updated to cover the chat tool.
• Tested with real questions; transcripts reviewed weekly at first.
• Your state’s current AI and bot rules checked.